Budget Android phones arrive with firmware malware that runs apps

Midnight Mimosa is a malware framework preinstalled in the system partition of low-cost Android phones that use MediaTek chips. Bitdefender spotted it when its app-monitoring tools flagged a system app called com.android.system.lite quietly adding and removing other apps.

The malicious parts pose as normal Android system packages, with names such as com.android.sys.prot and com.android.sys.gmsprot. Because they are signed as system software, Android treats them as trusted.

From that foothold, the main app downloads extra modules from command servers, the remote computers the attackers use to send orders. Researchers counted about 32 different apps pushed out this way, dressed up as weather tools, file managers, app lockers, note apps, audio editors and text scanners.

The campaign has run for roughly two years. Mexico had the most victims, ahead of France and Italy. The US came next, with Spain, Brazil and Germany also high on the list.

Most infected devices are cheap, off-brand or counterfeit phones. Bitdefender found the malware on models carrying the names of real budget brands, including the Cubot KINGKONG X and Doogee S200 X. Those two names alone covered more than 11% and 4% of infected devices respectively.

Many others were fakes that borrow flagship names. Bitdefender listed counterfeit iPhones calling themselves names like “i17 Pro Max” and knockoff Galaxy phones labeled “S25 Ultra” or “Note 18 Ultra.” Genuine Samsung and Apple phones are not affected.

The spread is wide. The 15 most common brands made up only 35.8% of infected devices, and the rest fell into a long tail of others. There is no full official list of affected models.

Owners on an Android enthusiast forum reported odd apps on Cubot and Doogee phones that kept reinstalling themselves after removal. One Doogee Fire 3 Max owner said an official firmware update brought the infection, which vanished after rolling back and came back when the update was reinstalled. Some owners said later updates from the makers fixed the problem.

The main trick is ad fraud. The fake apps carry a legitimate advertising toolkit, so the ad network pays them for each ad shown. The malware then loads ads in invisible windows and fakes taps on them, so advertisers pay for views no human ever sees.

It also covers its tracks. Before installing an app, it briefly switches off the Google Play Store app so Google Play Protect, Android’s built-in malware scanner, cannot check the install, then turns it back on. Some versions even rewrite the install record so the apps look as though they came from Google Play.

A second money-maker turns your phone into a residential proxy. That means strangers’ internet traffic can be routed through your home or mobile connection, hiding where it really comes from. A fake app locker carries this feature and registers the phone with a remote server. Bitdefender confirmed that server was live and accepting phones, though its test device never received traffic to relay. Researchers also warn that infected phones could be pulled into botnets, networks of hijacked devices used for attacks that flood websites with traffic.

The threat is not limited to dodgy hardware. Bitdefender found 13 apps on the Google Play Store with the same ad-fraud code, talking to Midnight Mimosa’s servers. They passed Google’s review and reached people searching for ordinary tools such as weather apps and QR scanners.

These Play Store apps cannot silently install other software, because they lack system powers. They can still show ads outside the app, even when you are not using the phone. They were published under at least two developer accounts, named fivedev and CPS Developer.

Who planted the firmware malware is still unknown. Bitdefender says the malicious app was signed with a certificate tied to Shenzhen Zediel, a real Chinese maker of Android devices, but the tampering could have happened at a manufacturer, a firmware supplier, a shipping partner or someone further down the chain.

If you own a cheap, no-name or knockoff Android phone, assume it could be affected, especially if you see apps you did not install, apps that return after you delete them, ads popping up outside apps, or unexplained data use.

• Do not rely on a factory reset. The malware sits in the system partition, which a reset leaves untouched.
• Keep sensitive accounts off the phone. Bitdefender advises against using such a device for banking, sign-in codes or important files.
• Scan it. Mobile security software may flag the infection.
• Ask for a replacement. Contact the seller or maker. Removing the malware takes firmware-level work or developer tools that most people cannot use.

When you buy your next phone, stick to known brands and authorized sellers. A rock-bottom price on a phone named after an iPhone or Galaxy is the clearest warning sign.